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(57) Abstract: Detection of items stored in a computer sys- 
tem such as computer code, data or information includes ob- 
taining signatures characteristic of programs of interest such 
as steganographic programs. A signature is obtained by read- 
ing code from a program of interest. The code may consist of 
the first 500 bytes from a .DDL file taken from the program's 
core steganographic kernel. This code is then the signature. 
The computer system compares (90) the signature with files 
it holds, other than files on a prearranged exclusion list (72). 
If a signature is found to match data in a file, the filename, 
the finding of steganography in it, the file location and the 
matched signature are recorded by the computer system for 
output (96) to its user. 
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